Qiujun Huang b139f8b00d fbcon: fix null-ptr-deref in fbcon_switch ... Set logo_shown to FBCON_LOGO_CANSHOW when the vc was deallocated. syzkaller report: https://lkml.org/lkml/2020/3/27/403 general protection fault, probably for non-canonical address 0xdffffc000000006c: 0000 [#1] SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000360-0x0000000000000367] RIP: 0010:fbcon_switch+0x28f/0x1740 drivers/video/fbdev/core/fbcon.c:2260 Call Trace: redraw_screen+0x2a8/0x770 drivers/tty/vt/vt.c:1008 vc_do_resize+0xfe7/0x1360 drivers/tty/vt/vt.c:1295 fbcon_init+0x1221/0x1ab0 drivers/video/fbdev/core/fbcon.c:1219 visual_init+0x305/0x5c0 drivers/tty/vt/vt.c:1062 do_bind_con_driver+0x536/0x890 drivers/tty/vt/vt.c:3542 do_take_over_console+0x453/0x5b0 drivers/tty/vt/vt.c:4122 do_fbcon_takeover+0x10b/0x210 drivers/video/fbdev/core/fbcon.c:588 fbcon_fb_registered+0x26b/0x340 drivers/video/fbdev/core/fbcon.c:3259 do_register_framebuffer drivers/video/fbdev/core/fbmem.c:1664 [inline] register_framebuffer+0x56e/0x980 drivers/video/fbdev/core/fbmem.c:1832 dlfb_usb_probe.cold+0x1743/0x1ba3 drivers/video/fbdev/udlfb.c:1735 usb_probe_interface+0x310/0x800 drivers/usb/core/driver.c:374 accessing vc_cons[logo_shown].d->vc_top causes the bug. Reported-by: syzbot+732528bae351682f1f27@syzkaller.appspotmail.com Signed-off-by: Qiujun Huang <hqjagain@gmail.com> Acked-by: Sam Ravnborg <sam@ravnborg.org> Cc: stable@vger.kernel.org Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch> Link: https://patchwork.freedesktop.org/patch/msgid/20200329085647.25133-1-hqjagain@gmail.com		2020-03-31 09:59:38 +02:00
..
accessibility
acpi	ACPI: PM: s2idle: Prevent spurious SCIs from waking up the system	2020-02-11 23:26:15 +01:00
amba
android	for-5.6/io_uring-vfs-2020-01-29	2020-01-29 18:53:37 -08:00
ata	libata-5.6-2020-02-05	2020-02-06 06:11:50 +00:00
atm	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next	2020-01-28 16:02:33 -08:00
auxdisplay
base	ARM: SoC-related driver updates	2020-02-08 14:04:19 -08:00
bcma	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next	2020-01-28 16:02:33 -08:00
block	Merge branch 'merge.nfs-fs_parse.1' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2020-02-08 13:26:41 -08:00
bluetooth	Bluetooth: btrtl: Use kvmalloc for FW allocations	2020-01-24 19:57:53 +01:00
bus	bus: moxtet: fix potential stack buffer overflow	2020-02-15 10:33:19 -08:00
cdrom
char	Minor bug fixes for IPMI	2020-02-16 13:05:46 -08:00
clk	ARM: SoC: late updates	2020-02-08 14:17:27 -08:00
clocksource	ARM: SoC: late updates	2020-02-08 14:17:27 -08:00
connector
counter
cpufreq	Merge branch 'pm-cpufreq'	2020-02-14 10:40:48 +01:00
cpuidle	ARM: SoC-related driver updates	2020-02-08 14:04:19 -08:00
crypto	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next	2020-01-28 16:02:33 -08:00
dax
dca
devfreq
dio
dma	ARM: Device-tree updates	2020-02-08 13:58:44 -08:00
dma-buf	dma-buf: Improve CONFIG_DMABUF_MOVE_NOTIFY help text	2020-03-25 14:36:46 -04:00
edac	EDAC/sysfs: Remove csrow objects on errors	2020-02-13 13:29:41 +01:00
eisa
extcon
firewire
firmware	ARM: SoC-related driver updates	2020-02-08 14:04:19 -08:00
fpga
fsi
gnss
gpio	gpio: sifive: fix static checker warning	2020-02-10 13:54:17 +01:00
gpu	drm/vc4: Fix HDMI mode validation	2020-03-27 13:38:47 +01:00
greybus
hid	drm pull for 5.6-rc1	2020-01-30 08:04:01 -08:00
hsi
hv	- Most of the commits here are work to enable host-initiated hibernation	2020-02-03 14:42:03 +00:00
hwmon	hwmon: (pmbus/xdpe12284) fix typo in compatible strings	2020-02-12 12:43:01 -08:00
hwspinlock
hwtracing
i2c	Merge branch 'i2c/for-5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux	2020-02-07 12:54:13 -08:00
i3c
ide	proc: convert everything to "struct proc_ops"	2020-02-04 03:05:26 +00:00
idle	intel_idle: Introduce 'states_off' module parameter	2020-02-03 11:57:18 +01:00
iio	chrome platform changes for 5.6	2020-02-04 07:17:41 +00:00
infiniband	IB/mlx5: Use div64_u64 for num_var_hw_entries calculation	2020-02-14 15:21:52 -04:00
input	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input	2020-02-15 16:49:25 -08:00
interconnect
iommu	IOMMU Updates for Linux v5.6	2020-02-05 17:49:54 +00:00
ipack
irqchip	irqchip/gic-v4.1: Avoid 64bit division for the sake of 32bit ARM	2020-02-09 15:47:37 -08:00
isdn	proc: convert everything to "struct proc_ops"	2020-02-04 03:05:26 +00:00
leds	leds: lm3532: add pointer to documentation and fix typo	2020-01-22 21:08:24 +01:00
lightnvm
macintosh	powerpc updates for 5.6	2020-02-04 13:06:46 +00:00
mailbox
mcb
md	block-5.6-2020-02-16	2020-02-16 12:35:52 -08:00
media	chrome platform changes for 5.6	2020-02-04 07:17:41 +00:00
memory
memstick
message
mfd	chrome platform changes for 5.6	2020-02-04 07:17:41 +00:00
misc	Merge branch 'i2c/for-5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux	2020-02-07 12:54:13 -08:00
mmc	ioremap changes for 5.6	2020-01-27 13:03:00 -08:00
mtd	treewide: remove redundant IS_ERR() before error code check	2020-02-04 03:05:27 +00:00
mux
net	net: hns3: fix a copying IPv6 address error in hclge_fd_get_flow_tuples()	2020-02-14 07:05:17 -08:00
nfc
ntb
nubus
nvdimm	mm: Cleanup __put_devmap_managed_page() vs ->page_free()	2020-01-31 10:30:37 -08:00
nvme	block-5.6-2020-02-16	2020-02-16 12:35:52 -08:00
nvmem	Merge branch 'i2c/for-5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux	2020-02-07 12:54:13 -08:00
of	ARM: SoC-related driver updates	2020-02-08 14:04:19 -08:00
opp	ioremap changes for 5.6	2020-01-27 13:03:00 -08:00
oprofile
parisc	proc: convert everything to "struct proc_ops"	2020-02-04 03:05:26 +00:00
parport
pci	pci-v5.6-fixes-1	2020-02-06 14:17:38 +00:00
pcmcia
perf	perf/smmuv3: Use platform_get_irq_optional() for wired interrupt	2020-02-10 18:14:46 +00:00
phy	treewide: remove redundant IS_ERR() before error code check	2020-02-04 03:05:27 +00:00
pinctrl	pinctrl: fix pxa2xx.c build warnings	2020-02-04 03:05:24 +00:00
platform	Merge branch 'akpm' (patches from Andrew)	2020-02-04 07:24:48 +00:00
pnp	proc: convert everything to "struct proc_ops"	2020-02-04 03:05:26 +00:00
power	ARM: SoC platform updates	2020-02-08 13:55:25 -08:00
powercap
pps
ps3
ptp
pwm
rapidio
ras
regulator	- New Drivers	2020-02-03 14:51:57 +00:00
remoteproc	remoteproc: qcom: q6v5-mss: Improve readability of reset_assert	2020-01-24 09:34:07 -08:00
reset
rpmsg
rtc	chrome platform changes for 5.6	2020-02-04 07:17:41 +00:00
s390	fix style of SPDX License Identifier	2020-02-11 20:14:28 +01:00
sbus
scsi	SCSI misc on 20200208	2020-02-08 17:24:41 -08:00
sfi
sh
siox
slimbus
soc	soc/tegra: fuse: Fix build with Tegra194 configuration	2020-02-11 15:00:15 -08:00
soundwire
spi	treewide: remove redundant IS_ERR() before error code check	2020-02-04 03:05:27 +00:00
spmi	spmi: pmic-arb: Set lockdep class for hierarchical irq domains	2020-02-10 13:16:04 +01:00
ssb
staging	proc: convert everything to "struct proc_ops"	2020-02-04 03:05:26 +00:00
target	SCSI misc on 20200129	2020-01-29 18:16:16 -08:00
tc	The main MIPS changes for 5.6:	2020-01-31 11:28:31 -08:00
tee	ARM: SoC-related driver updates	2020-02-08 14:04:19 -08:00
thermal	- Fix a SEVERE docs build failure for cpu idle cooling device (Randy Dunlap)	2020-01-31 14:39:21 -08:00
thunderbolt
tty	Kbuild updates for v5.6 (2nd)	2020-02-09 16:05:50 -08:00
uio
usb	Merge branch 'merge.nfs-fs_parse.1' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2020-02-08 13:26:41 -08:00
vfio	VFIO updates for v5.6-rc1	2020-02-03 22:22:05 +00:00
vhost
video	fbcon: fix null-ptr-deref in fbcon_switch	2020-03-31 09:59:38 +02:00
virt
virtio	virtio_balloon: Fix memory leaks on errors in virtballoon_probe()	2020-02-06 03:40:27 -05:00
visorbus
vlynq
vme	Char/Misc driver changes for 5.6-rc1	2020-01-29 10:35:54 -08:00
w1	Char/Misc driver changes for 5.6-rc1	2020-01-29 10:35:54 -08:00
watchdog	linux-watchdog 5.6-rc1 tag	2020-02-07 12:30:16 -08:00
xen	xen: branch for v5.6-rc1	2020-02-05 17:44:14 +00:00
zorro	Kbuild updates for v5.6 (2nd)	2020-02-09 16:05:50 -08:00
Kconfig
Makefile